So I'm currently trying to analyze a resource archive file of an old game.
What I got so far
- The file is supposed to represent a "virtual drive", the format is called VDRV. This means there are paths listed with offsets and sizes.
- Header structure is 64 bytes for the game identification (magic number + a whole lot of 0x00), then a uint32 for total file size, then a uint32 for the offset where the first block of data ends
- Data follows, the first block takes up more than 90% of archive size. This is where the resources have to be located. This seems to be ciphered/encrypted.
- What is left is what I call the "Resource Table" - a chain of either 64 or 120 bytes long blocks until the end of file. I believe this is where the paths are registered
So far, so good. However, this is where it get's tricky. The first twelve bytes of each of those blocks are readable, they are always three uint32.
- Length of the block including this int (either 64 or 120)
- Some offset, this seems to link the blocks in a LinkedList style (actually proved that using a small program I wrote).
- Offset of the last 4 bytes of this block.
And this is where I'm currently stuck, since the rest seems to be encrypted/ciphered data. I dumped the data from the 64 and 120 long blocks seperately, without those twelve "header" bytes. Each block is seperated by line break.
Now there are obviously some repeated patterns here, so I'm thinking that it might be some XOR-ish cipher, though I haven't been able to figure out a key or even a structure.
What I expect to find in this data
- Two uint32, offset and size
- A string path
- Unused space filled with 0x00
Also, I know that these (partial) strings should be in there somewhere in some way or another (got those from the executable):
data ../../../data/g g/img/inv_Lf._img g/img/inv_Rt._img g/img/inv_All._img g/img/mcUse._img g/img/mcTalk._img g/img/mcTake._img g/img/mcLook._img g/img/mcArrow._img g/img/fntOtherSpeakers._img g/img/fntBig._img g/img/fntWhite._img g/img/fntYellow._img g/img/fntGray._img
That is all I have been able to figure out up to now. Any help in figuring this out would be much appreciated!
Thank you for your time!
EDIT: Posted the binary in the comments